Privacy Policy

1. Who is responsible for your data

Vettri HRMS is operated by [Vettri legal entity name] (“Vettri”, “we”). We play two different roles:

• Data processor for employers. When an organisation (your employer) uses Vettri to manage its people, the employer is the data fiduciary: it decides what employee data is collected and why. We process that data only on the employer’s instructions, under our Data Processing Agreement. If you are an employee, your employer’s own privacy notice applies, and requests about your data should go to your employer first; the Privacy page inside the app shows your employer’s grievance officer.
• Data fiduciary for our own account holders. For the people who sign up for, buy, administer or contact us about Vettri (for example the details you give at signup or in a demo request), and for website visitors, Vettri is the data fiduciary and this policy is our notice to you.

2. Personal data we collect as a fiduciary

• Account and contact details: name, work email, phone, job role, organisation name, industry, size and country.
• Billing details: plan, billing contact, GSTIN and billing address. Card or UPI details are handled by our payment partner; we receive only a payment reference and status.
• Security and usage data: sign-in history, IP address, browser and device type, two-factor settings, and records of which legal documents you accepted and when.
• Support and communications: messages you send us and demo or contact-form details.

3. Employee data we process for employers

Depending on the modules an employer uses, Vettri may process: employee profile and contact details, job and reporting information, attendance punches (biometric device PINs, browser check-ins with location, optional selfie at check-in), leave, payroll and statutory identifiers (PAN, UAN, ESI, bank account), documents uploaded by HR or the employee, expense claims, onboarding records, assigned assets and devices, and the device data described below. We do not decide these purposes; the employer does.

Employees can see their own data, download a copy, ask for corrections and (after they leave and the employer’s retention period ends) ask for erasure, from the Privacy page in the app.

4. Employee device monitoring

If an employer installs the Vettri Windows Agent on work computers, the agent can collect:

• applications in use and active window titles, with start and end times;
• activity signals (active vs idle time based on keyboard and mouse activity counts — not the keys typed);
• device and hardware inventory: model, serial number, processor, memory, disk, Windows version, BIOS and installed software;
• device status: online/offline heartbeats, agent version and IP address;
• remote support sessions started by IT (screen view or control, and commands), which are logged.

The agent does not record keystrokes or typed content, passwords, browser data, personal file contents, webcam or microphone.

Employers can require each employee to read and accept a monitoring notice before a device is enrolled. Employees can review and withdraw consent from the Privacy page; the employer is notified and decides the consequences under its own policies, and may configure monitoring to pause automatically on withdrawal.

5. Why we use personal data (as a fiduciary)

We do not sell personal data and do not use employee data to train public AI models. The in-app assistant only reads data the signed-in user is already permitted to see.

6. Sharing and sub-processors

We share personal data only with service providers that help us run Vettri, under contracts that require them to protect it, with authorities when the law requires, or with a successor if our business is transferred (with notice to you). Current sub-processors:

[Sub-processor list to be confirmed before publication.] We will give administrators at least 30 days’ notice before adding a sub-processor that handles Customer Data.

7. Where data is stored

Customer Data is primarily stored in India ([AWS ap-south-1, Mumbai - to confirm]). Some providers above (for example content delivery and email) may process limited data outside India. Any transfer outside India follows the DPDP Act and any restrictions notified by the Central Government.

8. How long we keep data

• Account data: while your account is active, and for up to [90 days] after closure to handle queries, unless the law requires longer.
• Invoices and payment records: 8 years, as required by GST and tax law.
• Security logs: up to [1 year].
• Employee data: as configured by the employer. By default Vettri keeps payroll and statutory records for 7 years after an employee exits and other personal data for 24 months, after which an exited employee may request erasure. On erasure we anonymise the person’s name, contact, PAN, bank and address details and delete their uploaded documents, while keeping payroll figures the law requires.
• Backups: rotate out within [35 days].

9. Security

We use reasonable security safeguards as required by the DPDP Act and the Information Technology Act, 2000, including encryption in transit, hashed passwords, optional or mandatory two-factor authentication, per-company data isolation, role-based access with scopes, and audit logs. See our Security page.

10. Your rights

Under the DPDP Act you have the right to:

• get a summary of your personal data and how it is processed, and the identities of those it has been shared with;
• correct, complete or update inaccurate data;
• erasure of data that is no longer needed for the purpose or required by law;
• withdraw consent at any time (this does not affect processing already done);
• nominate another person to exercise your rights in case of death or incapacity;
• grievance redressal, and to complain to the Data Protection Board of India if your grievance is not resolved.

Account holders can contact us at privacy@vettrihrms.in. Employees should use the Privacy page in the app or contact their employer’s grievance officer; we help employers respond. We respond within 30 days.

11. Children

Vettri is a business service and is not intended for children. Employers who process data of employees under 18 must obtain verifiable parental consent where the law requires.

12. Cookies

Our website and app use essential cookies and local storage to keep you signed in and remember preferences. [Describe analytics cookies, if any, and how to opt out.]

13. Personal data breaches

If a personal data breach occurs, we will inform affected customers without undue delay so they can meet their obligations, and notify the Data Protection Board of India and affected individuals where we are the fiduciary, as required by the DPDP Act and its rules. Organisations can record a breach contact in Settings › Privacy & Data. CERT-In reporting obligations under the IT Act are also followed.

14. Changes to this policy

We will post updates here with a new version and date. If a change is material, signed-in users will be asked to review and accept the new version.

15. Grievance officer

Name: [Grievance officer name]
Email: grievance@vettrihrms.in
Address: [postal address]
We acknowledge grievances within 72 hours and aim to resolve them within 30 days.